CVE-2025-22891
📋 TL;DR
This vulnerability in F5 BIG-IP PEM allows undisclosed traffic to cause a denial of service by stopping the Virtual Server from processing new client connections and increasing memory usage. It affects BIG-IP systems with PEM Control Plane listener Virtual Servers configured with Diameter Endpoint profiles. Only supported software versions are affected.
💻 Affected Systems
- F5 BIG-IP Policy Enforcement Manager (PEM)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete denial of service for affected Virtual Servers, potentially disrupting critical network services and requiring manual intervention to restore functionality.
Likely Case
Service disruption for the affected Virtual Server, causing connection failures and degraded performance until the service is restarted.
If Mitigated
Limited impact with proper network segmentation and monitoring, allowing quick detection and remediation before widespread disruption.
🎯 Exploit Status
Exploitation requires sending specific undisclosed traffic patterns to the vulnerable configuration.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check F5 advisory K000139778 for specific fixed versions
Vendor Advisory: https://my.f5.com/manage/s/article/K000139778
Restart Required: No
Instructions:
1. Review F5 advisory K000139778 for affected versions. 2. Upgrade to fixed versions listed in advisory. 3. No service restart required according to advisory.
🔧 Temporary Workarounds
Disable Diameter Endpoint Profile
allRemove or disable Diameter Endpoint profile from PEM Control Plane listener Virtual Server configuration
tmsh modify ltm virtual <virtual_server_name> profiles delete { diameter-endpoint }
Implement Network Controls
allRestrict access to affected Virtual Servers using firewall rules or network segmentation
🧯 If You Can't Patch
- Implement strict network access controls to limit traffic to affected Virtual Servers
- Monitor memory usage and connection rates on affected systems for early detection
🔍 How to Verify
Check if Vulnerable:
Check if BIG-IP has PEM Control Plane listener Virtual Server with Diameter Endpoint profile: tmsh list ltm virtual <name> | grep -A5 -B5 diameter-endpointCheck Version:
tmsh show sys versionVerify Fix Applied:
Verify version is patched: tmsh show sys version | grep -i version, then compare to fixed versions in F5 advisory📡 Detection & Monitoring
Log Indicators:
- Virtual Server stop processing connections
- Abnormal memory usage spikes
- Connection failures in application logs
Network Indicators:
- Unusual traffic patterns to Diameter endpoints
- Increased connection timeouts
- Service unavailability
SIEM Query:
source="bigip_logs" AND ("Virtual Server stopped" OR "memory spike" OR "connection failure")